Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm hardly trying to add a Internet-Access group which is for our terminals where the client will see only a few sites.

I call them InternetUserTerminal the added lines are in bold, the starndard configuration for this house would be without the bolded ones.

but a get an infinitive loop, the blockedsites are only for bad-websites so standard users wont get to bad ones restricted access are only allowed to browse a whitelist and terminal access should be similar to restricted but with an other "whitelist" - the termiallist.

are there some smarter ways of how to solve this hole problem? i'll be fine too with an silmple answer to fixing this problem, but i'm young and lerning so if you have 2 minutes explaining me the smarter way, i'll be very thankfull!

/etc/squid3/squid.conf Configuration File

cache manager

provide basic authentication via ldap for clients not authenticated via kerberos/ntlm
auth_param basic program /usr/lib/squid3/squid_ldap_auth -R -b "dc=somewherein,dc=local" -D squid@somewherein.local -W /etc/squid3/ldappass.txt -f sAMAccountName=%s -h philipp.somewherein.local
auth_param basic children 10
auth_param basic realm Internet Proxy
auth_param basic credentialsttl 1 minute

ldap authorisation
external_acl_type memberof %LOGIN /usr/lib/squid3/squid_ldap_group -R -K -b "dc=somewherein,dc=local" -D squid@somewherein.local -W /etc/squid3/ldappass.txt -f "(&(objectclass=person)(sAMAccountName=%v)(memberof=cn=%g,ou=System,ou=IT,ou=Verwaltung,ou=Somewherein,dc=somewherein,dc=local))" -h philipp.somewherein.local

acl for proxy auth and ldap authorizations
acl auth proxy_auth REQUIRED
    aclname             acltype  typename activedirectorygroup
acl RestrictedAccess    external memberof "/etc/squid3/restricted_access.txt"
acl StandardAccess      external memberof "/etc/squid3/standard_access.txt"
acl FullAccess          external memberof "/etc/squid3/full_access.txt"
**acl TerminalAccess    external memberof "/etc/squid3/terminal_access.txt"**
acl allowedsites        dstdomain "/etc/squid3/allowedsites.txt"
acl blockedsites        dstdomain "/etc/squid3/blockedsites.txt"
**acl terminalsites dstdomain "/etc/squid3/terminalsites.txt"**

squid defaults
acl manager proto cache_object
acl localhost src ::1
acl to_localhost dst ::1
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost

enforce authentication, order of rules is important for authorization levels
http_access deny !auth

prevent access to basic auth prompt for BlockedAccess users
http_access allow RestrictedAccess allowedsites auth
http_access deny RestrictedAccess
http_access allow FullAccess auth
**http_access allow TerminalAccess terminalsites auth**
**http_access deny TerminalAccess**
http_access deny blockedsites
http_access allow StandardAccess auth
http_access allow auth

access_log /var/log/squid3/access.log squid !allowedsites

squid Debian defaults
http_port 3128
hierarchy_stoplist cgi-bin ?
coredump_dir /var/spool/squid3
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.